f80cf9326add3ab456637242fdc3310088d6ba4f7ff383b4bd1643bf8f982a67

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 08:06

Target

075a188372d1e5295ea9df563bc0e017_JaffaCakes118.dll
Size

308KB
MD5

075a188372d1e5295ea9df563bc0e017
SHA1

9732cb15c93f0ced24bd786a0281bd8f5eac20a3
SHA256

f80cf9326add3ab456637242fdc3310088d6ba4f7ff383b4bd1643bf8f982a67
SHA512

cd37e704eccdb1ffc3923e165b6f1f1508bfcc489f76d1ec55a02fe119d5da963690f5d2f6d994a09e653c1e5d9369f4bb4309dba81b5b65ee4e9b0fc9c10a5a
SSDEEP

6144:JrwtcXdrcR/7GHck3GIRXIbDccdjNSYsmIw5LhfhYrLjn+TBpAFCrX5:t9XdrcR/6jrMcCRfhYnjn+TYQ75

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
740	4200	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4200	968	rundll32.exe	80
PID 968 wrote to memory of 4200	968	rundll32.exe	80
PID 968 wrote to memory of 4200	968	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\075a188372d1e5295ea9df563bc0e017_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\075a188372d1e5295ea9df563bc0e017_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 680
    3⤵
    - Program crash
    PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4200 -ip 4200
1⤵
PID:2508